XInclude Resource Resolution Vulnerability in Copernik XML Factory

CVE-2026-61586

What is CVE-2026-61586?

Copernik XML Factory, which enables secure creation of JAXP factories for Java, is vulnerable due to improper handling of XInclude resource resolution. Before version 0.1.2, the product fails to block malicious XInclude references when an application enables XInclude processing. This can result in the disclosure of sensitive local files or the execution of server-side request forgery (SSRF) attacks via attacker-controlled XML content. Successful exploitation requires specific configurations and processing of untrusted XML, meaning that applications using the affected XML factory are at risk unless updated to the patched version 0.1.2.

References